Linux permissions and ACLs cheat sheet

The chapter on one page: what to remember, the commands to have at your fingertips, and flashcards for quick revision.

The chapter in eight sentences

Every file has an owner, a group and three permission sets: user, group and other. Only the first matching class applies.
On a file, r, w and x mean read, change and run. On a directory they mean list, create or delete entries, and enter.
Deleting a file needs write and execute on its directory; the file's own mode does not matter.
chmod takes symbols (u+x, g=r) or an octal number (r=4, w=2, x=1, summed per class); capital X adds execute to directories only.
chown user:group changes ownership; only root may give a file away.
The umask removes bits from the requested mode: 666 for files, 777 for directories.
setgid on a directory passes its group to new files, sticky stops users deleting each other's entries, and setuid runs a program as its owner.
An ACL adds named users and groups; the mask caps them, and a default ACL is a template for new files.

Command	Does
`ls -l`, `ls -ld DIR`	Permissions of files, or of a directory itself
`stat -c "%A %a %U:%G %n" F`	Symbols, octal, owner, group
`id [USER]`	Who you are, and your groups
`namei -l PATH`	Permissions of every directory on the way
`getfacl F`	Full ACL, with the mask and effective access

Command	Does
`chmod 640 F`	Set the mode with numbers
`chmod u=rw,g=r,o= F`	Set the mode with symbols
`chmod g+w F`, `chmod o-r F`	Change one thing
`chmod -R u=rwX,g=rX,o= DIR`	Recursive, without making files executable
`chown USER:GROUP F`, `chgrp GROUP F`	Change owner, group
`umask 027`	Defaults for new files (640) and directories (750)

Command	Does
`chmod 2770 DIR`, `chmod g+s DIR`	setgid: new files inherit the group
`chmod 1777 DIR`, `chmod +t DIR`	sticky: delete only your own
`find /usr -perm -4000`	List setuid programs
`setfacl -m u:NAME:r F`	Add or change a named entry
`setfacl -m g:NAME:rX DIR`	Same for a group; `X` = directories only
`setfacl -d -m u:NAME:r DIR`	Default ACL for new files
`setfacl -x u:NAME F`, `setfacl -b F`	Remove one entry, all entries

What do r, w and x mean on a regular file?: Read the contents, change them, run the file as a program.
What do r, w and x mean on a directory?: List the names, create/delete/rename entries (needs x too), and enter it or reach files by name.
Which permission class applies when you own the file and are also in its group?: The owner class only. The first match wins.
Octal values of r, w, x?: r = 4, w = 2, x = 1. Add them per class.
Set a file to rw-r-----, two ways?: chmod 640 file; chmod u=rw,g=r,o= file
Make directories enterable in a recursive change without making files executable?: chmod -R u=rwX,g=rX,o= tree (capital X)
Change owner and group in one command?: chown user:group file
What does umask 027 do to new files and directories?: Files 666 → 640, directories 777 → 750.
Shared directory whose files belong to the team group?: chgrp team dir; chmod 2770 dir (setgid)
Which bit stops users deleting each other's files in a shared directory?: The sticky bit: chmod +t dir (mode 1777 for /tmp).
Give john read access without changing owner or group?: setfacl -m u:john:r-- file; read it with getfacl file
Make new files in a directory inherit an ACL?: A default ACL: setfacl -m d:u:john:r-- dir